Philadelphia, PA – September 4, 2024 – Ferrilli, the leading provider of IT solutions for higher education, is excited to announce a series of strategic leadership changes designed to better serve its current and future clients. These changes are aimed at aligning internal resources, enhancing project management, and advancing employee development, ensuring Ferrilli remains at the forefront of innovation in the rapidly evolving higher education landscape.

Steven Christian has been appointed Chief Operating Officer (COO) of Ferrilli. Since joining the company in October 2015 as Executive Vice President (EVP), Christian has been instrumental in steering Ferrilli through a period of significant growth and transformation. In his new role, Christian will leverage his deep understanding of the company’s operations and client needs to ensure Ferrilli continues to deliver outstanding results. His leadership will be pivotal as the company navigates the next phase of its development and strives to exceed client expectations.

Mark Tuck has been named EVP of Client Growth. Tuck, who has been with Ferrilli since December 2016, began his journey as a Senior Consultant and most recently served as EVP of Professional Services. In his new role, Tuck will focus on strengthening and expanding client partnerships. His responsibilities will include aligning Ferrilli’s services with client goals and opportunities, reinforcing the company’s position as a trusted advisor, and driving growth through strategic client engagement.

Tracy Hokanson has been appointed Chief Services Officer. Hokanson, who officially joined Ferrilli in October 2023, brings a wealth of experience from her 24-year tenure at Ellucian, where most recently she held the position of Senior Director of Global Strategic Solutions. In her new role, Hokanson will be responsible for creating and implementing strategies that enhance service delivery and ensure alignment with Ferrilli’s overarching organizational goals. Her leadership will be crucial in making Ferrilli the first call for innovative solutions and a preferred employer in the industry.

These leadership changes are part of Ferrilli’s broader strategy to optimize internal operations, drive project success, and seize emerging opportunities within the higher education sector. By aligning resources more effectively and focusing on key areas of growth and development, Ferrilli aims to continue its legacy of excellence and innovation.

“Ferrilli is committed to not only meeting but exceeding the evolving needs of our clients,” said Robert Ferrilli, President of Ferrilli. “With Steven, Mark, and Tracy stepping into these pivotal roles, we are well-positioned to build on our recent successes and drive further growth. Their combined expertise and leadership will be instrumental as we continue to deliver exceptional value to our clients and shape the future of IT solutions in higher education.”

Ferrilli remains dedicated to advancing its mission of providing cutting-edge IT solutions and support to higher education institutions. The company’s refreshed leadership team is poised to enhance its ability to deliver transformative solutions and foster lasting partnerships in the years ahead.

About Ferrilli

Ferrilli is a leading provider of IT solutions tailored specifically for higher education institutions. With a focus on innovation, client success, and strategic growth, Ferrilli helps colleges and universities navigate the complexities of technology to achieve their academic and operational goals. For more information, visit https://www.ferrilli.com/

Media Contact:

Jeff Dusing
Marketing Manager
jdusing@ferrilli.com
856.633.7280
Ferrilli.com

Last Giving Tuesday, we announced that Ferrilli joined Pledge 1% as a corporate partner.  

As part of our commitment, we pledged to donate 100 complimentary hours of security services to institutions that fell victim to a cyber attack. 

One year later and we’re proud to report that we are delivering on that promise.  

In 2021, we donated 3% of our profit back in hours worked; lending our time, expertise, and resources to help several institutions navigate the complex aftermath of a cyber incident.  And we are continuing that great work throughout 2022 and beyond.  

Higher education has increasingly become a favorite target of cyber criminals. That’s why we took the pledge to help protect our community.  

Learn more: https://go.ferrilli.com/l/957602/2022-11-29/bdjyx?utm_source=website&utm_medium=post&utm_campaign=givingtuesday22 

We’re attending the Pennsylvania Banner Users Group 2022 Annual Conference, November 13-15, in Harrisburg, Pennsylvania! 

Connect with Jessica Bonelli and the rest of the Ferrilli team to learn about our Ellucian Banner consulting services. As an Ellucian Platinum Services partner, we’re uniquely positioned to help your institution optimize and streamline its Banner #ERP system.  

Also, be sure to check out our two live sessions, hosted by Ferrilli’s Banner experts Carol Thomas, Dr. Lauraly DuBois, and Carlos Alca: 

Implementing Banner with the Shared Technology Platform (STP): Considerations for a Successful Outcome on Monday, 11/14, at 2pm ET. 

Migrating from Banner SSB8 to Banner SSB9: A Pathway to Success Description on Tuesday, 11/15, at 9am ET. 

See you soon at PABUG 2022! 

Ferrilli is excited to be a sponsor at the MECA Conference on October 20-21! 

Be sure to connect with Ferrilli’s Jessica Bonelli, Jeffery Lehman and Thomas Hausmann throughout the event to learn how our Ellucian ERP consultants and support team leverage unmatched technical and functional expertise to improve operations and business processes, reduce costs, and delight users across the campus. 

And don’t miss our live session on Friday at 11:30am CT: ‘Technology alone is not enough: The Case for Assessing Business Practices to Improve ERP Efficiency.’ 

We look forward to seeing you there! 

We’re at the 2022 Cohesion Summit on October 18-21, 2022, in Reno, Nevada! 

Be sure to connect with Ferrilli’s team of dedicated higher education technology experts throughout the event. And don’t miss our live session on Wednesday, October 19^th, at 10am PT, as we discuss how to seamlessly manage the transition to #EllucianBanner Self Service 9! 

Ferrilli is excited to be a gold sponsor at the 2022 National Council for Workforce Education Conference! 

Be sure to connect with Ferrilli’s Kelly Sinacola and Marcia A. Daniel at Booth #32 while in Portland, Oregon. And don’t miss our presentation on Thursday, October 13, 2022, covering the essentials of datasecurity. 

We look forward to seeing you at NCWE 2022.

We’re excited to announce that Ferrilli has been named to the Philadelphia100® list for the 5^th time!

As a 5-time winner, Ferrilli earned a spot in the prestigious Philadelphia100® Hall of Fame; a distinction shared by just 28 other companies.

Ferrilli landed at No. 53 on this year’s list, which recognizes the fastest growing, privately-held companies in the region.

Growth translates into more opportunities for the company and greater client value creation. We’re excited share this honor with the entire Ferrilli team and our higher education community.

We’re going for the green at Educause 2022! 

Stop by Booth 935 on Tuesday, October 25^th – Friday, October 28^th, to play Ferrilli’s $50,000, hole-in-one challenge! 

We’ll also be raffling off a once-in-a-lifetime trip to the beautiful Pebble Beach Resorts, located between picturesque Monterey and Carmel, California. 

Our team of talented higher education technology experts will be there to cheer you on … and, of course, answer any questions you have about optimizing your institution’s technology. 

You do not want to miss this! Just look for the massive, state-of-the-art golf simulator and come over to take your shot! 

We’re alerting our higher education technology community that support for Windows Server 2012 and 2012 R2, including security updates, are coming to an end in one year.

Extended Support for these operating systems will end on October 10, 2023.

If you haven’t thought about migrating your servers to newer versions, now is a good time to start!

Considering that these projects can take significant time to schedule and execute, the earlier you start the better off you will be. Many organizations faced challenges when Windows Server 2008 and 2008 R2 were end-of-life. It is important not to be caught in a similar position this time around.

We have also been noticing that IT security initiatives are on the rise and having out-of-service OSes is often a top item to resolve. Security auditors will mark these servers as a risk to be remediated and mitigations are often costly and service impacting. Our team recommends avoiding the hassle and starting your upgrade project now.

As always, if you have any questions or support needs around this project, Ferrilli is here to help. We have the expertise and working knowledge to help you upgrade or migrate your servers with minimal impact to end-users.​

Attending the North Carolina Community College System Conference on October 9-11? 

Be sure to stop by Booth 829 at the Raleigh Convention Center to connect with Ferrilli’s Marcia A. Daniel and Rita Jerman, EdD, and learn about our commitment to helping North Carolina community colleges deliver high-quality, accessible educational opportunities to their communities!  

By: Armando D’Onorio (CISSP, GSLC, GCCC), Ferrilli’s Chief Information Security Officer & Senior Consultant

We’re alerting our higher education community to act quickly and patch the latest vulnerabilities from Google and Microsoft:

• Google Chrome: An exploit for CVE-2022-1364 exists and it is strongly recommended that everyone install the latest Google Chrome update (100.0.4896.127) as soon as possible.
• Microsoft RDP: Critical Windows RPC CVE-2022-26809 flaw raises concerns due to its potential for widespread, significant cyberattacks. Therefore, all organizations need to apply Windows security updates as soon as possible.

Note: While our focus is on getting the academic systems updated, please remind your faculty, staff, and students to patch their personal devices.

More info about the vulnerabilities: 

​​​​Google Chrome

• Google officials did not release many details about the flaw, saying that information and links about the bug are being restricted until most users are updated. The emergency updates the company issued this week impacted almost 3 billion users of its Chrome browser as well as those using other Chromium-based browsers, such as Microsoft Edge, Brave and Vivaldi. They will also retain restrictions if the bug exists in a third-party library that other projects similarly depend on but have not yet fixed. The vulnerability is a so-called “confusion” weakness in Chrome’s V8 JavaScript engine. This type of flaw often leads to browser crashes, but the high severity label for this specific vulnerability suggests that it could be the rarer kind that allows attackers to execute damaging code depending on the privileges associated with the application. An attacker could view, change, or delete data, according to the Center for Internet Security.

Microsoft RDP: CVSS:3.1 9.8 / 8.5

• Microsoft fixed this vulnerability as part of the April 2022 Patch Tuesday updates and rated it as ‘Critical,’ as it allows unauthorized remote code execution through a bug in the Microsoft Remote Procedure Call (RPC) communication protocol (TCP 445 and 135). If exploited, any commands will be executed at the same privilege level as the RPC server, which in many cases has elevated or SYSTEM level permissions, providing full administrative access to the exploited device. Security researchers believe the bug has the potential to be exploited in widespread attacks, like what we saw with the 2003 Blaster worm and 2017 Wannacry attacks utilizing the Eternal Blue vulnerability. Currently there are over 1.3 million devices exposing port 445 to the Internet, offering a massive pool of targets to exploit. It is important to stress that institutions should apply the patch because it can surface in several configurations of both client and server RPC services. This vulnerability is ideal for spreading laterally in a network and security experts believe we will surely see it used by ransomware gangs in the future.

What Version Should You Be on Google Chrome?
The latest fix will bring Chrome to version 100.0.4896.127 across Windows, Linux, and Mac platforms. Remind your users to close their browsers so the Chrome updates will be applied in the coming days and weeks, as Chrome automatically installs the latest patch when the browser is closed and relaunched.

If you have any questions or need assistance, please click here.

We’re following up from our Russian Cyber Activity webinar earlier this month to provide our higher education community with the latest updates and advice on the Russian cyber threat:

The U.S. Government has called the current moment “critical” in working towards enhancing its cybersecurity defenses and believes the threat of cyberattack from Russia is looming against the United States.

Government officials stated this reinforces the urgent need for all organizations, large and small, and even individuals to act now to protect themselves against malicious cyber activity.

The following information can help you be prepared:

Report anomalous cyber activity and/or cyber incidents as soon as possible!

The CISA is working closely with federal and industry partners to monitor the threat environment 24/7 and they stand ready to help organizations respond to and recover from cyberattacks.

Visit CISA.gov/Shields-Up for information on how to protect your network(s) and how to report anomalous cyber activity and/or incidents. When cyber activity/incidents are reported quickly, it can contribute to stopping further attacks.

• report@cisa.gov
• (888) 282-0870, or
• Your FBI Field Office or CISA Regional Office

What Can Be Done?

• Treat people as your first line of defense – Educate your employees on common tactics (email and websites) and how to report suspicious activity and investigate their reports promptly and thoroughly.
• Test your emergency procedures for backups and restoring services/data. Ensure you have offline backups beyond the reach of malicious actors.
• Encrypt your data so it can not be used if stolen.
• Verify your communication channels work and know the players and their roles in your Emergency Response Team.
• Ensure software and hardware patching is current and up to date.
• Enable multifactor authentication on all accounts/systems/devices connecting to your network(s).
• Engage proactively with your local FBI field office or CISA Regional Office to establish relationships in advance of any cyber incidents.

Cybersecurity advice to share with co-workers, family and friends

• Pay extra attention to email: Your work email address, as well as any personal email addresses, are the most common starting places for a targeted attack.
• Protect yourself:
  • DO NOT FOLLOW LINKS contained in emails or in text messages – If you feel the communication is legitimate, navigate to the main website by typing in the primary site address and then navigate to the desired page/resource. o    Verify the email using a different contact method – Voice calling is particularly powerful in vetting outreach.
  • Use strong passwords and multi-factor authentication to reduce compromises by unwanted hackers.
  • Protect your devices and home network – keep them up to date and use antivirus software. Use the latest supported versions, apply security patches promptly, use anti-virus and scan regularly to guard against known malware threats.
  • Beware of new outreach in social media platforms (Twitter, Instagram, Snapchat, Facebook, etc.) and text messages from unknown phone numbers or groups.
• Protect others:
  • REPORT any suspected communications or activity to your Helpdesk or IT department.
  • Report suspicious outreach received at your personal email addresses by reporting them to your service provider via their published resources.
  • DO NOT FORWARD or share:
    • unvetted outreach or “recommended” content.
    • suspicious messages Delete them immediately.

Thank you and please stay safe!​

With the passage of the Fiscal Year 2022 Federal budget on March 15, 2022, new Pell entitlement figures have been approved, increasing the maximum Pell grant award $400, to $6,895 for the 2022-23 award year.

While this increase is beneficial for students, it will also require action for Financial Aid Offices that have already begun packaging students for the upcoming year.

Impacts for Previously Award Students

The increase to the maximum Pell grant award may have several impacts to the aid packages of students who have previously been awarded for the 2022-23 award year.

• Students awarded Pell grants will likely see an increase to their award entitlement.
• An increased Pell award may require adjustment to other Federal and institutional awards, as the higher Pell amount will reduce the student’s overall unmet need.
• Depending on the institution’s SIS/ERP packaging configuration and functionality, adjustments to student awards may require software updates and/or manual review and adjustment.

How to Prepare for Updating Student Pell Awards and Award Packages

There are several steps Financial Aid Offices can take to prepare to implement these changes in their SIS/ERP systems and repackage previously awarded students.

• Identify any previously packaged students who received Pell as part of their 2022-23 award package. Since this population will need to be reviewed, identifying the population in advance will allow Financial Aid Office staff to better prepare for award revisions when the SIS/ERP is capable of processing them.
• Monitor communication from your institution’s SIS/ERP vendor indicating what system changes need to be made to accommodate the new Pell entitlements. Generally, this may only require parameter updates for the new amounts but depending on other changes that may have been made to the entitlement grids, software updates may be required as well.
• Monitor communications from the Department of Education regarding the reprocessing of ISIRs to reflect the updated Pell amounts. Even if your software vendor provides guidance/updates for accommodating the increased award amounts, a new ISIR transaction will still need to be received to correctly calculate a student’s award.
• Determine if your institution will make adjustments to any previously awarded institutional need-based aid. In other words, if Pell is increased will your institution decrease its need-based award offer or allow previous amounts to remain unchanged. If the latter option is chosen, this may result in the need to revise Subsidized Stafford Loan amounts in the student’s award package.
• Identify any not yet packaged students with Pell grant eligibility. Excluding these students from the packaging process until the necessary system changes and reprocessed ISIRs have been received will prevent providing inaccurate awards to students and reduce the need for additional repackaging by Financial Aid Office staff.
• Communicate with your students about revisions to their awards. When students and their families see news of these changes due to the approval of the Federal Budget, they may have questions about how they will be impacted and when they will see revisions to their award package. Providing this information preemptively to both students needing revisions as well as student who may have their packages delayed may help to allay their concerns and reduce inquiries to their institution’s Financial Aid Office.

Please don’t hesitate to contact us if you require assistance updating student Pell awards and award packages. We’re here to help!​​​​​

By: Armando D’Onorio (CISSP, GSLC, GCCC), Ferrilli’s Chief Information Security Officer & Senior Consultant

Higher education institutions should be more on guard than ever for cyber attacks. Due to the current political climate, we are seeing an increase in attacks, especially attacks originating from Russia.

In the past week, our security team has seen two Russian attacks on U.S. institutions; as well as two other institutions hit hard by phishing schemes.

We will be holding an emergency webinar on Thursday, March 17^th, 2022, to discuss the threat and provide action steps for protection. Stay tuned for more details. And please stay safe!

By: Armando D’Onorio (CISSP, GSLC, GCCC), Ferrilli’s Chief Information Security Officer & Senior Consultant

As the U.S. imposes sanctions on Russia for its ongoing aggression with Ukraine; security experts at the Wall Street Journal’s virtual CIO Network Summit this week recommended that the U.S. should prepare for possible cyber retaliation.

Recommendations and Awareness

Recommendations that came from the Summit included locking accounts after two or three failed login attempts and being aware that the Russian operatives could be using password spraying attacks; recycling passwords from past password data dumps; and may likely be using artificial intelligence to access networks.

Russia has been known to use hybrid warfare strategies and utilize cyberattacks against their adversaries. Professionals who monitor cyber threats, both for governments and corporations, are concerned that the worst is yet to come, in the form of both direct attacks by Russia and collateral damage from their cyber attacks.

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has issued a warning to U.S. business that says they should be prepared to defend against cyber attacks originating from Russia. “Every organization—large and small—must be prepared to respond to disruptive cyber activity.”

Russian Hackers began at least as early as January targeting Ukraine with “wiper” malware which is designed to destroy hard drive data by wiping their contents completely. Professionals who monitor cyber threats, both for governments and corporations, are on high alert because Russia has a history of unleashing cyberweapons that wreak havoc far beyond the computers and networks that were their original targets.

What Can You Do to Protect Your Student and Employee Data?

The House Armed Services Committee recommends institutions be testing procedures for backups and restoring data, enabling multifactor authentication on devices connected to their networks, and ensuring software is up to date on patching to protect their networks from known vulnerabilities.

Here are Some Additional Mitigating Tips and Helpful Layers of Defense

• Prepare by documenting what you have. Identify every application and asset running in your IT environment. This level of granularity will allow you to quickly map critical assets, data, and backups, and to identify vulnerabilities and risks. By having a complete picture of your network and data environments, you’ll be able to respond and act quickly during an attack or breach.
• Utilize segmentation and alerting where possible to help prevent ransomware propagation and lateral movement. Create perimeters around critical applications, backups, file servers and databases. Restrict traffic between users, applications, and devices to help block lateral movement. These blocked access attempts become your indicators of compromise. Incorporate reputation-based detection that alerts to the presence of known malicious domains and processes. Set up security monitoring so you are collecting the data that will be needed to analyze network intrusions.
• Test your backups and recovery methods. Make sure to have backups off-site and visualization capabilities that support phased recovery strategies in which connectivity is gradually restored as different areas of the network are validated as “all clear.”
• Do not expose management interfaces of network devices to the internet. The management interface is a significant attack surface, so not exposing them reduces your risk. Web based interfaces are convenient for managing networking equipment, but under no circumstances should these be open to the world and the internet.
• Protect your devices and networks by keeping them up to date. Use the latest supported versions, apply security patches promptly, use anti-virus and scan regularly to guard against known malware threats.
• Use multi-factor authentication to reduce the impact of password compromises.
• Treat people as your first line of defense. Tell staff how to report suspected phishing emails, and ensure they feel confident to do so. They are your first line of defense, investigate their reports promptly and thoroughly. Never punish users for clicking phishing links or opening attachments.

By: Armando D’Onorio (CISSP, GSLC, GCCC), Ferrilli’s Chief Information Security Officer & Senior Consultant

VMware is urging customers to patch bugs in ESXi, Workstation, Fusion and Cloud Foundation running in on-premises or co-located settings.

The ramifications of the combined vulnerabilities are serious, especially if attackers have access to workloads inside your environments.

The patches fix a total of five (5) CVEs in those products that were disclosed during the Tianfu Cup, a Chinese security event that VMware participates in.

We’re increasing awareness for our higher education community

Knowing that most academic institutions have increased their use of VMware to help with the increase of remote work and labs from home for their employees and students.

Ferrilli is increasing the awareness and recommending that institutions pay extra close attention to failed VMware patches on their systems. Double-check that all systems have been properly patched (servers, workstations, and laptops).

**Remind all your users to patch their personal devices.**

More info about the vulnerabilities

The VMware vulnerabilities include use-after-free (UAF) bugs, double-fetch, unauthorized access, and denial of service bugs. While the individual bugs don’t reach the critical level, VMware says the combined bugs should be treated as such because they can be combined to result in higher severity.

• ESXi, Workstation and Fusion contain:
  • A UAF bug (CVE-2021-22040) in XHCI USB controller that could allow a bad actor with local admin privileges on a virtual machine to execute code as he virtual machine’s VMZ process running on the host.
  • A double-fetch bug (CVE-2021-22041) that could also lead to unauthorized code execution on the virtual machine’s VMX process running on the host.
• ESXi also contains:
  • An unauthorized access vulnerability (CVE-2021-22042) due to VMX having access to settings authorization tickets. A malicious actor with privileges in the VMX process only could access settings service running as a high priority user.
  • A Time-of-check Time-of-use bug (CVE-2021-22043) that exists in the way temporary files ae handled that could be used to escalate privileges by writing arbitrary files.
  • A slow HTTP Post denial-of-service vulnerability in rhttpproxy that could be used to create a denial-of-service condition by overwhelming rhttpproxy service with multiple requests.

For more information on workarounds and patching these vulnerabilities, read VMware’s advisory and the company’s associated blog.

If you have any questions or need assistance, please click here to get help.

By: Armando D’Onorio (CISSP, GSLC, GCCC), Ferrilli’s Chief Information Security Officer & Senior Consultant

Google has released a NEW update for the Chrome browser for Windows, Mac, and Linux, to fix a high-severity, zero-day vulnerability used by threat actors in attacks.

“Google is aware of reports that an exploit for CVE-2022-0609 exists in the wild.”

It is it strongly recommended that everyone install yesterday’s (2/15/2022) Google Chrome update as soon as possible.

We’re increasing awareness for our higher education community

Ferrilli is recommending that academic institutions pay close attention to failed patches on their systems and double-check that all systems have been patched (workstations, laptops, and servers). Please remind your faculty, staff, and students to patch their personal devices.

More info about the vulnerability

This is the first Chrome zero-day fix for this year . This vulnerability was discovered by Google’s Threat Analysis Group. While Google said they have detected attacks exploiting this zero-day, it did not share any additional info regarding these incidents or technical details about the vulnerability.

Very few details of the security flaw have been revealed but UAF vulnerabilities typically facilitate attacks such as arbitrary code execution and data corruption in unpatched software and can lead to the takeover of a victim’s machine.

The zero-day, tracked as CVE-2022-0609 is carrying a CVSSv3 score of 9.8/10.

What Version Should You Be On?

The latest stable build (98.0.4758.102) for Windows, Mac, and Linux brings with it a total of 11 security fixes, with many of the highest-severity flaws relating to use after free (UAF) vulnerabilities.

If you have any questions or need assistance, please click here to get help.

By: Armando D’Onorio (CISSP, GSLC, GCCC), Ferrilli’s Chief Information Security Officer & Senior Consultant

A zero-click attack surface for the popular video conferencing solution Zoom has yielded two security vulnerabilities that could have been exploited to crash the service, execute malicious code, and even leak arbitrary areas of its memory.

The weaknesses have been addressed by Zoom as part of their updates. Failure to patch all your systems could provide the needed pivot-point for threat actors to gain access into your network environment.

We’re increasing awareness for our higher education community:

Ferrilli is recommending that academic institutions pay close attention to failed patches on their systems and double-check that all systems have been patched (workstations, laptops, and multimedia router (MMR) servers). Also, remind your faculty, staff, and students to patch their personal devices.

More info about the vulnerabilities:

A zero-click attack against the Windows Zoom client was revealed at Pwn2Own (a security event designed to identify and flag vulnerabilities before they’re exploited by threat actors) showing that it does indeed have a fully remote attack surface. This resulted in two vulnerabilities being reported to Zoom. One was a buffer overflow that affected both Zoom clients and MMR servers, and one was an info leak that is only useful to attackers on MMR servers.

Here are the CVE numbers associated with the two flaws that were identified:

• CVE-2021-34423 (CVSS score: 9.8) – A buffer overflow vulnerability that can be leveraged to crash the service or application or execute arbitrary code.
• CVE-2021-34424 (CVSS score: 7.5) – A process memory exposure flaw that could be used to potentially gain insight into arbitrary areas of the product’s memory.

Goal of a zero-click attack:

For threat actors to stealthily gain control over the victim’s device without requiring any kind of interaction from the user (such as clicking on a link). A key trait of zero-click hacks is their ability not to leave behind traces of malicious activity, making them very difficult to detect.

If you have any questions or need assistance, please click here.

By: Armando D’Onorio (CISSP, GSLC, GCCC), Ferrilli’s Chief Information Security Officer & Senior Consultant

We’re alerting our higher education technology community that yesterday’s (1/11/2022) Microsoft Patch Tuesday released critical security updates for Exchange and Windows OS that addresses several serious security vulnerabilities.

In the updates there are fixes for 97 total vulnerabilities, 9 of these are remote code exploits (RCE), 6 of them are classed as Zero-Day, and 1 of them is Wormable.

A wormable exploit means that it could self-propagate through a network with no user interaction. This vulnerability exploits how the OS processes unauthenticated HTTP traffic and carries a severity rating of 9.8 on a scale of 10. Windows Server 2019 and 2022, plus Windows 10 and 11 are affected.

Microsoft suggests patching all affected Windows versions as soon as possible, publicly facing servers with open HTTP and HTTPS ports are the most critical. The security updates for Exchange affect 2013, 2016, and 2019 and this includes hybrid servers for Office 365.

The update has only been released for the latest Cumulative Update (CU) for Exchange Server 2013 (CU23), and the last two CUs for 2016 (CU21 and CU22) and 2019 (CU10 and CU11). This means you will need to patch to one of these CUs before being able to apply this security update.

If you have any questions or need assistance, please click here.

For your reference, click here to read the Microsoft Exchange Team posted a blog about the update and patch process.

By: Armando D’Onorio (CISSP, GSLC, GCCC), Ferrilli’s Chief Information Security Officer & Senior Consultant

We’re alerting our higher education technology community that on December 9, a remote code execution vulnerability, dubbed CVE-2021-44228, was disclosed in Apache’s Log4j.

Apache Log4j is an open-source logging utility used by almost all major Java-based applications and currently running on 3 billion devices worldwide.

Log4j has been exposed to a very high-risk vulnerability under active and vigorous exploitation. The exploitation of this vulnerability is simple and only requires the attacker to enter a piece of code into the target triggering the vulnerability, allowing the attacker to remotely control the user victim’s server.

How Do I Tell If I’m at Risk?

Chances are, you have a system(s) at risk. While advanced features of many popular Next Generation Firewalls (NGFWs) or Web Application Firewalls (WAFs) may offer some protection, you still need to patch quickly. We recommend two immediate steps to figure out your level of exposure.

Attending SACSCOC 2021 virtual?

Then be sure to stop by our booth to chat live with our team of experts and learn how your institution can maximize its technology investment!

We’ll also be hosting 3(!) live video sessions:

Friday, December 3^rd @ 11 am ET – Increase Completion Rates with Ferrilli’s Automated Degree & Certificate Evaluator for Ellucian Banner (with Ferrilli’s Senior Vice President Carol Thomas)

Friday, December 3^rd @ 3:45 pm ET – Increase Efficiency with Program Requirement Managed Services (with Ferrilli’s Executive Vice President Kelly Sinacola)

Monday, December 6^th @ 1:15 pm ET – Increase Completion Rates with Ferrilli’s Automated Degree & Certificate Evaluator for Ellucian Colleague (with Kelly Sinacola)

We look forward to connecting with you!

By Marcia Daniel, Chief Client Officer, Ferrilli

When I meet with institutional leaders across the higher education landscape, I am continually astounded at just how tech-savvy they have become. Provosts are asking about about degree audit software. Registrars want to discuss how best to deploy chatbots. Vice Presidents of Student Life are exploring the benefits of digital nudges. Just about everyone in higher education is a technology expert these days – except in the area that matters most.

Because when I ask them about what they’re doing to ensure data security, there’s a familiar refrain I hear all too often: “Oh, our CIO handles that.”

We’re going for the green at EDUCAUSE 2021!

Be sure to stop by Booth 101 on Wednesday, October 27^th and Thursday, October 28^th, to play Ferrilli’s $50,000, hole-in-one challenge!

We’ll also be raffling off a once-in-a-lifetime trip to the beautiful Pebble Beach Resorts, located between picturesque Monterey and Carmel, California.

Our team of talented higher education technology experts will be there to cheer you on … and, of course, answer any questions you have about optimizing your institution’s technology investment.

You do not want to miss this! Just look for the massive, state-of-the-art golf simulator and come over to take your shot!

We’re excited to announce that Ferrilli has been selected to the 2021 Philadelphia100® list.

Ferrilli landed at No. 61 on the list, which recognizes the fastest growing, privately-held companies in the region.

When the COVID-19 pandemic struck, the San Jose-Evergreen Community College District needed to act fast to ensure that its 20,000 students could continue their studies unabated. Job One was finding a way for its 665 administrators, staff, and full-time faculty perform their essential roles from off-campus locations. That meant creating a remote workforce: providing remote access to the technology, tools, and applications they rely on to help support the student body.

Within a matter of days, SJECCD identified the major challenges it needed to navigate – many of which were impacting institutions across the higher education landscape. VPN solutions hadn’t been fully deployed and had to be scaled up. The use of unmanaged devices and unknown WIFI connections created security concerns. There was the potential that employees could unwittingly utilize malicious browser plug-ins. And there simply wasn’t enough hardware to support shifting the entire workforce to remote locations at the same time.

When COVID-19 struck in the spring of 2020, colleges and universities across the country were presented with three key challenges. They had to shift thousands of students, faculty, and employees to remote learning, instruction, and work. They had to do it quickly or risk losing an entire semester to the pandemic. And they had to do it securely or risk the creation of data vulnerabilities that hackers would likely exploit. 

Prior to the coronavirus pandemic, higher education was already one of the most targeted industries in the world when it came to cyberattacks. In 2019, Moody’s (which controls the bond ratings for most institutions in the U.S.) reported that data security was “a growing risk for higher education institutions globally” due to the fact that they “retain valuable information across expansive online networks;” that “their breadth of operations can be vast, with innumerable access points;” and that “investing in state-of-the-art defenses likely competes with myriad other priorities.” 

Since the pandemic began, cyber criminals have sought to take advantage of these trends like never before. According to a report released by Checkpoint in the summer of 2020, “the number of attacks on educational institutions has grown faster than in any other sector,” with “a 30 percent increase compared to a 6.5 percent increase across all industries in July and August [2020].” During the same time period, Microsoft Security Intelligence found that more than 60 percent of some 9 million malware encounters worldwide took place in the education sector alone. 

It was trends and statistics like these that were on the minds of leaders at the San Jose-Evergreen Community College District when ensuring that its 20,000 students could continue their studies unabated amid the coronavirus pandemic. 665 administrators, staff, and full-time faculty would have to perform their essential roles from off-campus locations – and that meant providing remote access to the technology, tools, and applications they rely on to help support the student body. 

Key Takeaways

• Ferrilli has been named an Ellucian Solution Services Platinum Partner, Ellucian’s highest partner level
• Only 4 Ellucian partners worldwide have attained this distinction
• The Ellucian and Ferrilli partnership provides top-tier service and support for institutions looking to get the most out of their Ellucian software
• This partnership produces a natural synergy between the world’s leading higher education technology systems provider and the premier information technology consultants serving higher education

By Marcia A. Daniel, Chief Client Officer, Ferrilli

Earlier this month, I read a news item that is increasingly common as cloud software becomes more prevalent in higher education. It detailed planned cuts to the IT team at a major institution in my home state. While the financial stresses of the pandemic were cited as a primary motivator, administrators also pointed to the more “cost-effective model” of becoming a “cloud-first organization.”

Those administrators are indeed correct that the cloud is more efficient; but I would argue that they are mistaken as to the reasons why.

We’re excited to appear in the spring 2021 edition of Toggle magazine alongside Pratt Institute VP of IT & CIO Joseph Hemway!

Toggle highlighted the impressive job Joe and his team did of responding to the COVID-19 pandemic by migrating Pratt’s world-class campus experience into a student-centered digital experience that felt like being there in person.

Pratt, in partnership with Ferrilli, leveraged Salesforce Communities to achieve their vision of an all-encompassing student-centered online platform; one that will set the standard for such portals going forward.

We were truly honored to work on this project and we are happy that Joe and his team are getting the recognition they deserve for such an impactful result.

“It was probably one of the most challenging projects of my career but also one of the most rewarding,” says Ferrilli CEO Robert Ferrilli. “It’s the top design school in the country and we had to deliver the best digital experience. I’m very happy we chose the Salesforce platform because of its flexibility and rich ecosystem.”

Click here to read the full story.

We’re excited to be a sponsor at Ellucian Live 2021, April 12-14. Here’s how you can connect with us during the conference:

FERRILLI INTERACTIVE BOOTH

Make sure to stop by our virtual booth where you can live chat with our higher education technology experts and check out special offers and promotions for Ellucian Live attendees.

SIMULIVE SESSIONS

We are hosting two Simulive sessions during the conference. These interactive sessions include a 30-minute presentation followed by a 15-minute live Q&A!

Future-Proofing your Ellucian Banner ERP with Ferrilli’s Senior Vice President Carol Thomas – Tuesday, April 13th at 1:00pm EDT

Future-Proofing your Ellucian Colleague ERP with Ferrilli’s Executive Vice President Kelly Sinacola – Tuesday, April 13th at 1:00pm EDT

We look forward to connecting with you!

We are often asked “What does Ferrilli do?” Here is an example of what Ferrilli can do to help improve your institution’s CRM:

We have designed a solution that auto closes extra opportunities on a record when a record hits certain funnel stages, such as Opportunity Creation, Application Submission, Denied, Withdrawn, and Enrolled.

This solution streamlines the opportunity management process. And we work with each individual school to ensure the solution is configured to fit their unique business process needs!

Expect more from your technology. Get more with Ferrilli!

We are often asked “What does Ferrilli do?” Here is an example of what Ferrilli can do to help improve your systems:

We migrated one of our CORE System Administration clients from UNIX HP-UX to Linux Red Hat in order to avoid issues with an aging server environment.

Post-migration, the staff saw a significant improvement. In fact, the financial aid auto packager went from taking 12 hours to 12 minutes!

Expect more from your technology. Get more with Ferrilli!

We are often asked “What does Ferrilli do?” Here is an example of what Ferrilli can do for higher education system administration:

We worked with a client to migrate their Direct Deposit back to the delivered functionality. By doing so, we were able to eliminate a customization that required regular review during software updates, saving the institution’s staff time and resources.

Expect more from your technology. Get more with Ferrilli!

We are often asked “What does Ferrilli do?” Here is an example of what Ferrilli can do for student accounts:

We recently automated a school’s student refund process. The initial process required students to initiate refunds with a paper request form before the form passed through multiple offices for approval, eventually ending with a paper check refund.

Now, the automated process allows staff to identify refunds proactively and return money directly to the students’ credit cards, saving the school from dealing with paper request forms, paper checks, returned mail, and student frustration. We generate creative ideas to solve business problems!

Expect more from your technology. Get more with Ferrilli!

We are often asked “What does Ferrilli do?” Here is an example of what Ferrilli can do for students, faculty, and staff:

During the summer of 2020, to deal with the ramifications of Covid-19, we helped several colleges and universities change:

– Fall term dates and all of the related dates throughout Ellucian Colleague®
– Instructional methods for those sections and faculty
– Section days and times
– Buildings and rooms for sections (using custom utilities rather than having to make these changes manually)

Each campus was able to rely on our depth and breadth of experience with Ellucian Colleague to make sure all of the appropriate areas were updated, saving considerable staff hours and resources.

Expect more from your technology. Get more with Ferrilli!

We are often asked “What does Ferrilli do?” Here is an example of what Ferrilli can do for students:

For one of our Ellucian Banner CORE Systems Support clients we recently worked with the Registrar’s office on their COVID modality changes for the 2021 spring term.

The work helped students understand and navigate the information around the course delivery changes to their schedules and course sections. Using the detailed planning information provided by the Registrar’s office, Ferrilli consultants quickly updated various Banner tables which saved the Registrar’s office from having to input changes for each course and section.

Expect more from your technology. Get more with Ferrilli!

We are often asked “What does Ferrilli do?” Here is an example of what Ferrilli can do to help improve communications within Ellucian Colleague:

We provided training on one campus to Admissions, Financial Aid, and the Business Office on Communications Management in Colleague. An Admissions staff member had been processing all Admissions-pending documents on PCEX one-by-one. She learned about PCB batch processing during training, which now saves her one hour per day!

Expect more from your technology. Get more with Ferrilli!

We are often asked “What does Ferrilli do?” Here is an example of what Ferrilli can do to help improve your degree audit functionality:

We have re-written countless program requirements for campuses across the country, always with the goal of giving students and faculty advisors a streamlined view of degree requirements and progress towards that degree.

We couple that with specialized training so each office is empowered with the knowledge to maintain those programs moving forward.

Expect more from your technology. Get more with Ferrilli!

We are often asked “What does Ferrilli do?” Here is an example of what Ferrilli can do to help improve your CRM:

We have designed external web applications that connect to the Slate CRM to retrieve data and display this as information to internal stakeholders. This has included information such as upcoming visitors, reporting, data analytics/comparison, and more.

We have also created specialty portals for specific populations on campus to view data such as a portal for coaches to view athletes and alumni to view other alumni for outreach activities.

Expect more from your technology. Get more with Ferrilli!

We are often asked “What does Ferrilli do?” Here is an example of what Ferrilli can do to help improve efficiency in your registrar’s office:

ERPs are complex systems that get updated regularly and it is hard to stay up to date on all of the features and functionality. That is where Ferrilli comes in!

We saved one office from hand-entering 700-plus sections per semester during a recent training opportunity in the registrar’s office.

Expect more from your technology. Get more with Ferrilli!

We are often asked “What does Ferrilli do?” Here is an example of what Ferrilli can do for System Administration:

We provided a client in need of optimizing their security with Ferrilli-designed Ellucian Colleague security analytical reporting. These reports allowed the client to see a complete picture of their security and make sound decisions about redesign and fixes.

Expect more from your technology. Get more with Ferrilli!

We are often asked “What does Ferrilli do?” Here is an example of what Ferrilli can do for Students:

Ferrilli’s Automated Degree & Certificate Evaluator helped an East Coast community college grant more than 60 certificates in a single year to students who otherwise would not have known they earned those certifications.

The custom, configurable solution also helped a Midwest community college realize a 70% increase in certificates awarded in the first year of its implementation, with a 10% to 30% increase in the years since.

Additionally, the Automated Degree & Certificate Evaluator assisted a large California community college in awarding approximately 500 additional credentials in the first term.

Expect more from your technology. Get more with Ferrilli!

We are often asked “What does Ferrilli do?” Here is an example of what Ferrilli can do for System Stabilization:

Ferrilli CORE System Administration Services worked with an institution that had daily outages of their Ellucian Colleague system. After Ferrilli rebuilt and reconfigured their system, the outages stopped.

On the first day of registration, the institution’s Director of IT called Ferrilli just to make sure that her phone was working. Usually on registration days, her phone would ring off the hook. Thanks to Ferrilli’s efforts, she hadn’t received a call all day.

Expect more from your technology. Get more with Ferrilli!

We are often asked “What does Ferrilli do?” Here is an example of what Ferrilli can do for System Administration:

During an Ellucian Colleague ERP assessment, Ferrilli discovered that a significant amount of time was being spent by Admissions tracking student credentials. We developed a process to automate student account creation, eliminating a cumbersome and frustrating process that relied on spreadsheets and helpdesk tickets. The new process also removed a potential security issue.

Expect more from your technology. Get more with Ferrilli!

We are often asked “What does Ferrilli do?” Here is an example of what Ferrilli can do for Students:

An Ellucian Colleague client had a requirement to align all registration dates to the actual start/end dates of their classes. To support this scenario, we built out the institution’s requirements in delivered functionality, with the use of custom subroutines. The updates we put in place shortened to process from days to minutes.

Expect more from your technology. Get more with Ferrilli!

This past weekend, as I was thinking about the many challenges that face all of us in our personal and professional lives, I was drawn to a book that I found quite inspiring. Many of you may be familiar with the work of Brené Brown. Her book Dare to Lead: Brave Work. Tough Conversations. Whole Hearts is, in my opinion, a book for this time. Big questions about leadership and bravery, openness to feedback, and heartfelt willingness.

+ Read More

The move to work-at-home has revealed limitations in many institutional phone systems. Some systems may not have been configured to support remote work, or for some systems it might not even be possible. Institutions with systems that do not have flexibility find themselves making some difficult decisions within offices to try to accommodate student needs.

+ Read More

College and University technology leaders across the country, indeed across the globe, have demonstrated great agility and adaptability in the face of moving to remote education and work. For many, the effort can be described as “turning on a dime.” Some institutions have made this transition by benefiting from institutional strategies that focused on mobility.

+ Read More

Business continuity is paramount at any time, but particularly now. Ferrilli has been supporting many schools that use the Ellucian Colleague® system with a service called CORE System Administration services. We are pleased to announce that we are now extending that service to our Ellucian Banner® clients.

+ Read More

Over my many years in higher education technology leadership the word innovation has been used, perhaps overused, to describe what we do with technology. As I’ve watched colleagues move, with some trepidation, to new working environments I’ve seen innovation at its finest. 

+ Read More

Who on earth starts writing a blog during a pandemic? Interestly, more people than you might expect. Technology provides wonderful ways to express feelings (read just about any Facebook page), make new traditions, and keep folks informed. There is some terrific work going on in the world today.

+ Read More

Check out the case study on Ferrilli’s partnership with New York City School Support Services (NYCSSS) published by Toggle Magazine. Ferrilli is the main IT support for NYCSSS: computers, phone, printers, ERP, security, networking, and more!

Click to read the full story.

The “WannaCry” virus has infected numerous computers around the world. The WannaCry virus can infect a server or desktop without any end user interaction. According to White House homeland security adviser Tom Bossert, more than 300,000 computers have been infected.

This virus impacts most modern Microsoft Windows Operating Systems. + Read More